Topic: Crashes also in libaprutil-1.dll with 2.4.69[session_crypto]

[larsonk]

Hi,

I have 6 servers that have been running fine with Apache2.4.x software for several years on Windows 2022 Servers.

This crash happens the same on servers that have the latest 2026-10 KB5126655 MS OS Server 2022 patch and servers that do not have the latest patch.

The servers connect to Tomcat 9 using a secret via mod_jk.

I'm seeing a similar crash to the previously reported LDAP issue.

Mine is in the mod_session_crypto module.

Windows Log shows:

Faulting application name: httpd.exe, version: 2.4.69.0, time stamp: 0x6abe0d7f
Faulting module name: libaprutil-1.dll, version: 1.6.5.0, time stamp: 0x6abe0bd1
Exception code: 0xc0000005
Fault offset: 0x00000000000039e0
Faulting process id: 0x29c8
Faulting application start time: 0x01dd62652350b8de
Faulting application path: F:\Apache24\bin\httpd.exe
Faulting module path: F:\Apache24\bin\libaprutil-1.dll
Report Id: c8fbcbb1-a4ae-4302-ab78-75feccd3dad7
Faulting package full name:
Faulting package-relative application ID:

When I replace the mod_session_crypto.so file with the .68 version, all is well.

I see this module is still considered Experimental per the website: https://httpd.apache.org/docs/current/mod/mod_session_crypto.html

Should I just continue with the .68 version or can the .69 version be "fixed" or am I missing some change on how this module works?

I see 11 changes to mod_session_crypto in the changelog, but am not sure how any of them apply to our setup:
https://downloads.apache.org/httpd/CHANGES_2.4

I'm wondering/guessing: Does mod_jk need a change based on this mod_session_crypto change?

*) SECURITY: CVE-2016-0736 (cve.mitre.org)
mod_session_crypto: Authenticate the session data/cookie with a
MAC (SipHash) to prevent deciphering or tampering with a padding
oracle attack. [Yann Ylavic, Colm MacCarthaigh]

FWIW, we use self-signed certificates on our servers which cannot reach the Internet.

Also, Modules loaded are:

mod_access_compat
mod_actions
mod_alias
mod_allowmethods
mod_asis
mod_auth_basic
mod_authn_core
mod_authn_file
mod_authz_core
mod_authz_groupfile
mod_authz_host
mod_authz_user
mod_autoindex
mod_cgi
mod_dir
mod_env
mod_headers
mod_include
mod_info
mod_isapi
mod_ldap
mod_log_config
mod_mime
mod_negotiation
mod_reqtimeout
mod_rewrite
mod_session_cookie
mod_session_crypto
mod_session
mod_setenvif
mod_socache_shmcb
mod_status
mod_unique_id
mod_usertrack
mod_ssl
mod_jk